LoFP LoFP / local accounts managed by privileged account management tools

Techniques

Sample rules

Local User Creation

Description

Detects local user creation on Windows servers, which shouldn’t happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.

Detection logic

condition: selection
selection:
  EventID: 4720